ISO 27001 Clause 7.5 Documented information Implementation Guideline
Required activity The organization includes documented information within the ISMS as directly required by ISO/IEC 27001 , also as determined by the organization as being necessary for the effectiveness of the ISMS. Implementation Guideline Documented information is required to define and communicate information security objectives, policy, guidelines, instructions, controls, processes, procedures, and what persons or groups of individuals are expected to try to do and the way they’re expected to behave. Documented information is additionally needed for audits of the ISMS and to take care of a stable ISMS when persons in key roles change. Further, documented information is required for recording actions, decisions and outcome(s) of ISMS processes and knowledge security controls . Documented information can contain: Information about information security objectives, risks, requirements and standards; Information about processes and procedures to be followed; ...